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DETAILED ACTION 

1. Claims 1-6, 8-17, 19-28, 30-39, 41-50, 52-61, 63-74 are 
pending . 

2. Amendment filed 10/05/2005 with a request for continued 
examination has been received and considered. 

Claim Rejections - 35 USC §103 

3. Claims 1-6, 8, 10-17, 19, 21-28, 30, 32-39, 41, 43-50, 52, 
54-61, 63, 65-66, 72-74 are rejected under 35 U.S.C. 103(a) as 
being unpatentable over "Symantec System Center Implementation 
Guide (hereinafter Symantec) further in view of Chen et al (U.S. 
5,960,170), further in view of Brown ("Data Communications") and 
further in view of Graham ("URLs for HTTP Servers") . 

As per claims 1, 12, 23, 34, 45, 56, Symantec discloses a 
computer program product, method, and computer comprising a 
computer program operable to control a reporting computer to 
report occurrence of an event to a receiving computer, said 
computer program comprising: report generating logic operable to 
generate report data identifying said reporting computer and 
said event (see pages 72-73) ; data retrieving logic operable to 
fetch requested data from said receiving computer to said 
reporting computer upon a request of said reporting computer 
(see pages 13, 18) . 
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Symantec fails to disclose report sending logic operable to 
send said report data from said reporting computer to said 
receiving computer upon fetching of said requested data. 

However, Chen et al teaches such a sending method (see 
column 7 lines 33-45) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to use Chen et al's method 
of sending reports to send Symantec's generated reports. 

Motivation to do so would have been to provide iterative 
virus detection (see Chen et al column 2 lines 62-63) . 

The modified Symantec and Chen et al system fails to 
disclose sending data while fetching data. 

However, Brown teaches this two was communication (see page 

2) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to use Brown's two-way 
communication to send and receive the data of the modified 
Symantec and Chen et al system. 

Motivation to do so would have been to allow both 
communications to work at the same time (see Brown page 2) . 

The modified Symantec, Chen et al, and Brown system 
discloses the use of URLs , but fails to disclose the data 
retrieving logic and said report sending logic use an internet 
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URL to specify said requested data to said receiving computer, 
said internet URL also containing said report data to be sent to 
said receiving computer. 

However, Graham teaches such a limitation sending of 
information in a URL (see section 8.1.1). 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to send the data of the 
modified Symantec, Chen et al, and Brown system using the URLs 
of Graham. 

Motivation to do so would have been to pass arguments to 
the server (see section 8.1.1). 

As per claims 2, 13, 24, 35, 46, 57, the modified Symantec, 
Chen et al, Brown, and Graham system discloses the event is 
detection of a computer file containing an unwanted computer 
program (see Symantec page 73 figure) . 

As per claims 3, 14, 25, 36, 47, 58, the modified Symantec, 
Chen et al, Brown, and Graham system discloses the unwanted 
computer program is a computer virus (see Symantec page 73 
figure) . 

As per claims 4, 15, 26, 37, 48, 59, the modified Symantec, 
Chen et al, Brown, and Graham system discloses the requested 
data is a description of said event (see Symantec pages 13 and 
18) . 
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As per claims 5, 16, 27, 38, 49, 60, the modified Symantec, 
Chen et al, Brown, and Graham system discloses the event is 
detection of a computer file containing a computer virus (see 
Symantec page 73) and the requested data is a description of the 
computer virus (see Symantec page 18). 

As per claims 6, 17, 28, 39, 50, 61, the modified Symantec, 
Chen et al, Brown, and Graham system discloses the event is 
detection of a computer file containing a computer virus (see 
Symantec page 73) ; and said requested data is an updated set of 
computer virus detecting data for use in detecting computer 
viruses (see Symantec page 18) . 

As per claims 8, 19, 30, 41, 52, 63, the modified Symantec, 
Chen et al, Brown, and Graham system discloses said reporting 
computer collates report data specifying one or more events that 
is sent together from said reporting computer to said receiving 
computer after fetching of said requested data (see Symantec 
page 73 figure) . 

As per claims 10, 21, 32, 43, 54, 65, the modified 
Symantec, Chen et al, Brown, and Graham system discloses said 
reporting computer and said receiving computer communicate via 
an internet link (see Chen et al column 5 lines 39-57). 

As per claims 11, 22, 33, 44, 55, 66, the modified 
Symantec, Chen et al, Brown, and Graham system discloses said 
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reporting data includes one or more of: a MAC address 
identifying a network card of said reporting computer; a date of 
said event; a time of said event; an identifier of a computer 
program used by said reporting computer to detect said event; an 
identifier of a version of a computer program used by said 
reporting computer to detect, said event; an identifier of a set 
of event detecting data used by a computer program used by said 
reporting computer to detect said event; an identifier of an 
event type detected by said reporting computer; an action taken 
by said reporting computer upon detection of said event; and a 
checksum of a file that triggered said event (see Symantec page 
73) . 

As per claims 72-74, the modified Symantec, Chen et al, 
Brown, and Graham system fails to disclose: not displaying the 
URL, displaying the URL as a link and selecting the link sends a 
request to the receiving computer. 

However, Official Notice is taken that at the time of the 
invention one of ordinary skill in the art would have displayed 
the URL as a link and that the link sends a request. 

Motivation to do so would have been to give a description 
of what the URL will lead to, and select the link to bring the 
user to the location specified by the URL. 
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4. Claims 9, 20, 31, 42, 53, 64 are rejected under 35 
U.S.C. 103(a) as being unpatentable over the modified Symantec, 
Chen et al, Brown, and Graham system as applied to claims 1, 12, 
23, 34, 45, 56 above, and further in view of Menezes et al 
("Handbook of Applied Cryptography"). 

As per claims 9, 20, 31, 42, 53, 64, the modified Symantec, 
Chen et al, Brown and Graham system fails to disclose the report 
data is encrypted by said reporting computer and decrypted by 
said receiving computer. 

However, Menezes et al discloses encrypting of data (see 
pages 15-16) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to use Menezes et al's 
method of encryption to encrypt the report data of the modified 
Symantec, Chen et al, Brown and Graham system. 

Motivation to do so would have been achieve confidentiality 
(see Menezes et al page 12) . 

5. Claim 67 is rejected under 35 U.S.C. 103(a) as being 
unpatentable over the modified Symantec, Chen et al, Brown, and 
Graham system as applied to claim 1 above, in view of Norton 
(Norton Antivirus Corporate Edition Implementation Guide) in 
view of Grundy (US 5291598) . 
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The modified Symantec, Chen et al, Brown, and Graham system 
discloses the report data includes: the identity of the 
computer, the date, the time, the computer program used, and the 
type of event (see Symantec page 73) . 

The modified Symantec, Chen et al, Brown, and Graham system 
fails to disclose including a MAC address, a version of the 
program used, an identifier of a set of event detecting data 
used, an action taken by the computer, and a checksum of the 
file. 

However, Norton teaches a version of the program used, an 
identifier of a set of event detecting data used, an action 
taken by the computer (see pages 286-287) and Grundy teaches 
using a checksum of a file (see column 18 lines 45-57) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to include the information 
of Norton and the checksum of Grundy in the modified Symantec, 
Chen et al, Brown, and Graham system. 

Motivation to do so would have been to be able to view the 
virus activity and scanning on the network (see Norton page 286) 
and to make sure the file isn't corrupt (see Grundy column 18 
lines 45-57) . 

Official Notice is taken that at the time of the invention 
it would have been obvious to use a MAC address to identify the 
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computer. Motivation to do so would have been that MAC 
addresses provide a unique identity of a computer. 

6. Claims 68-69 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over the modified Symantec, Chen et al, Brown, and 
Graham system as applied to claim 1 above, and further in view 
of Williams (US 20020138435) . 

As per claims 68-69, the modified Symantec, Chen et al, 
Brown, and Graham system discloses running a script on the 
receiving computer (see Graham), but fails to disclose using the 
script to decrypt data. 

However, Williams teaches a script is used for encrypting 
and decrypting data (see paragraphs 16 and 42) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to include a decryption 
script the modified Symantec, Chen et al, Brown, and Graham 
system. 

Motivation to do so would have been to prevent illicit 
copies of the information (see Williams paragraph 42) . 

7. Claims 70-71 rejected under 35 U.S.C. 103(a) as being 
unpatentable over the modified Symantec, Chen et al, Brown, and 
Graham system as applied to claim 1 above, and further in view 
of Cox et al (US 6842861) . 
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As per claims 70-71, the modified Symantec, Chen et al, 
Brown, and Graham system fails to disclose including a driver 
that started a virus in a report. 

However, Cox et al teaches a driver starting a virus (see 
column 1 lines 21-39) . 

At the time of the invention it would have been obvious to 
a person of ordinary skill in the art to include the driver that 
started the virus on a report. 

Motivation to do so would have been to know what was 
infected (see column 1 lines 21-39) . 

Response to Arguments 

8. Applicant's arguments filed 03/20/2006 have been fully 
considered but they are not persuasive. Applicant argues the URL 
of Graham does not specify the requested data; Symantec fails to 
disclose a description of the event; Symantec does not show the 
requested being a description of the computer virus; the report 
data of Symantec is not sent together from the reporting 
computer to the receiving computer during the fetch of the 
requested data. 

Regarding Applicant's argument that the URL of Graham does 
not specify the requested data, Applicant is reminded that one 
cannot show nonobviousness by attacking references individually 
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where the rejections are based on combinations of references. 
See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re 
Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). 
Graham is relied upon to show that a URL a send data and this 
data is what is defined as the requested data in the combination 
of Symantec and Chen et al. 

Regarding Applicant's argument that Symantec fails to 
disclose a description of the event, the alert described on 
pages 13, 18 and 73 of Symantec clearly describe an event, by 
showing when, where and what happened. 

Regarding Applicant's argument that Symantec does not show 
the requested being a description of the computer virus, 
Symantec is relied upon for its teaching of the report data with 
the report data describing an event, by showing when, where and 
what happened and Chen et al teaches sending the requested 
report data. 

Regarding Applicant's argument the report data of Symantec 
is not sent together from the reporting computer to the 
receiving computer during the fetch of the requested data; 
Symantec teaches generating a list of all alerts generated by 
the network computers. In the combination these alerts were 
collected during the fetch of the requested data as taught by 
Chen et al, therefore, the combination teaches collating report 
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data specifying one or more events sent together from the 
reporting computer to the receiving computer during the fetch of 
the requested data. 

Conclusion 

9. THIS ACTION IS MADE FINAL. Applicant is reminded of the 
extension of time policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action 
is set to expire THREE MONTHS from the mailing date of this 
action. In the event a first reply is filed within TWO MONTHS 
of the mailing date of this final action and the advisory action 
is not mailed until after the end of the THREE-MONTH shortened 
statutory period, then the shortened statutory period will 
expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated 
from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than 
SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier 
communications from the examiner should be directed to Michael 
Pyzocha whose telephone number is (571) 272-3875. The examiner 
can normally be reached on 7:00am - 4:30pm first Fridays of the 
bi-week off. 
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If attempts to reach the examiner by telephone are 
unsuccessful, the examiner's supervisor, Emmanuel Moise can be 
reached on (571) 272-3865. The fax phone number for the 
organization where this application or proceeding is assigned is 
703-872-9306. 

Information regarding the status of an application may be 
obtained from the Patent Application Information Retrieval 
(PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on 
access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free) . 
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SUPERVISORY PATENT EXAMINER 




